blocks|key|239008|text|1)是的，你是对的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|239009|2)可以。您可以选择更优雅地处理HTTP+403.4代码(需要SSL)，方法是自动将客户端重定向到页面的HTTPS版本。|239010|至于身份验证cookies，我已经为你找到了这个MSDN+article。基本上，您可以将您的网站(和客户端浏览器)设置为仅通过HTTPS传输身份验证cookie。这样它就不会受到未加密通道上的网络侦听的影响。|offset|length|239011|当然，只有当您的所有[Authorize]操作都是纯HTTPS时，这才是可能的。|style|CODE|239012|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/ff648341.aspx#paght000012_step3^0|0|0|O|C|0|0|A|B|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$F|W|G|X|1|Y]]|A|$]]|$1|H|3|I|5|6|7|Z|8|@$F|10|G|11|J|K]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]]]

1) Yes, you are right.

2) Yes. You can optionally handle HTTP 403.4 code (SSL required) more gracefully, by automatically redirecting the client to the HTTPS version of the page.

As for authentication cookies, I've found this <a href="http://msdn.microsoft.com/en-us/library/ff648341.aspx#paght000012_step3" rel="nofollow">MSDN article</a> for you. Basically, you can set up your website (and the client's browser) to only transmit authentication cookie via HTTPS. This way it won't be subject to network snooping over unencrypted channel.

Of course, this is only possible if all of your <code>[Authorize]</code> actions are HTTPS-only.

blocks|key|237255|text|从你的问题开始，首先，(1)+yes+nothing将阻止你在中使用同一页的http+ether+https。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|237256|和(2)是你需要添加你的逻辑在什么页面将只显示为https和什么作为http。如果有人想知道，为什么不全部显示为https，原因是速度，当你发送它们为https时，页面更大，编码/解码需要更多一点，所以如果你不需要https，只需将其切换为http。|237257|Switching+Between+HTTP+and+HTTPS+Automatically是一个非常好的代码，用于快速和简单地实现开关逻辑。|237258|曲奇饼|237259|当cookie与用户的凭据有关时，您需要强制仅使用安全页面进行传输。这意味着，如果你用https设置一个cookie，这个cookie不会在不安全的页面上传输，所以保持安全，中间的人不能窃取它。这里的提示是，这个cookie不能在http页面上读取-所以您可以知道用户在安全页面上是A，还是B。|237260|购物车-产品|237261|是的，这是正常的:将产品和购物车留在不安全的连接上，因为信息并不那么特殊。当你访问用户真实数据时，你会打开https页面，比如姓名、电子邮件、地址等。|237262|身份验证cookie|237263|如果将其设置为secure+only，则此cookies不会显示/读取/存在于不安全页面。如果你不保证它的安全，那就是一个问题。|237264|Response.Cookies[s].Secure+=+true;|code-block|syntax|javascript|237265|再说几句话|237266|我们对安全和非安全页面所做的是，我们实际上将用户数据分成两部分。一个是安全的，另一个是不安全的。所以我们实际上使用了两个cookie，一个是安全的，另一个是不安全的。|237267|例如，不安全的cookie是连接购物车上的所有产品的cookie，或者可能是用户的历史记录(产品看到的内容)这也是我们实际上并不关心是否有人得到它，因为即使是代理也可以从url看到用户历史或用户看到的内容。|237268|安全cookie是一种身份验证，它为用户保留了一些关键信息。因此，不安全的cookie在页面上的任何地方都与用户一起存在，安全cookie仅在结帐时、登录时等。|237269|相关|237270|MSDN,+How+To:+Protect+Forms+Authentication+in+ASP.NET+2.0|237271|Setting+up+SSL+page+only+on+login+page|237272|Can+some+hacker+steal+the+cookie+from+a+user+and+login+with+that+name+on+a+web+site?|237273|entityMap|0|LINK|mutability|MUTABLE|url|http://www.codeproject.com/Articles/5523/Switching-Between-HTTP-and-HTTPS-Automatically|1|http://msdn.microsoft.com/en-us/library/ff648341.aspx|2|https://stackoverflow.com/questions/6561483/setting-up-ssl-page-only-on-login-page/6561544|3|https://stackoverflow.com/questions/2498599/can-some-hacker-steal-the-cookie-from-a-user-and-login-with-that-name-on-a-web-s^0|F|3|V|N|0|5|X|0|0|1A|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|1L|1|0|0|12|2|0|0|2C|3|0^^$0|@$1|2|3|4|5|6|7|1U|8|@$9|1V|A|1W|B|C]|$9|1X|A|1Y|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1Z|8|@$9|20|A|21|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|22|8|@]|D|@$9|23|A|24|1|25]]|E|$]]|$1|J|3|K|5|6|7|26|8|@]|D|@]|E|$]]|$1|L|3|M|5|6|7|27|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|28|8|@]|D|@]|E|$]]|$1|P|3|Q|5|6|7|29|8|@]|D|@]|E|$]]|$1|R|3|S|5|6|7|2A|8|@]|D|@]|E|$]]|$1|T|3|U|5|6|7|2B|8|@]|D|@]|E|$]]|$1|V|3|W|5|X|7|2C|8|@]|D|@]|E|$Y|Z]]|$1|10|3|11|5|6|7|2D|8|@]|D|@]|E|$]]|$1|12|3|13|5|6|7|2E|8|@]|D|@]|E|$]]|$1|14|3|15|5|6|7|2F|8|@]|D|@]|E|$]]|$1|16|3|17|5|6|7|2G|8|@]|D|@]|E|$]]|$1|18|3|19|5|6|7|2H|8|@]|D|@]|E|$]]|$1|1A|3|1B|5|6|7|2I|8|@]|D|@$9|2J|A|2K|1|2L]]|E|$]]|$1|1C|3|1D|5|6|7|2M|8|@]|D|@$9|2N|A|2O|1|2P]]|E|$]]|$1|1E|3|1F|5|6|7|2Q|8|@]|D|@$9|2R|A|2S|1|2T]]|E|$]]|$1|1G|3|-4|5|6|7|2U|8|@]|D|@]|E|$]]]|1H|$1I|$5|1J|1K|1L|E|$1M|1N]]|1O|$5|1J|1K|1L|E|$1M|1P]]|1Q|$5|1J|1K|1L|E|$1M|1R]]|1S|$5|1J|1K|1L|E|$1M|1T]]]]

Starting with your questions, on one, (1) yes nothing will stop you to use for the same pages http ether https.

and (2) Yes you need to add your logic on what page will be show only as https and what as http. If some one wondering, why not show all as https the reason is the speed, when you send them as https the page are bigger and the encode/decode is take a little bit more, so if you do not need https, just switch it to http.

<a href="http://www.codeproject.com/Articles/5523/Switching-Between-HTTP-and-HTTPS-Automatically" rel="nofollow noreferrer">Switching Between HTTP and HTTPS Automatically</a> is a very good code to use for the implementation of switching logic fast and easy.

<h2>Cookies</h2>

When the cookie have to do with the credential of the user then you need to force it to be transmitted only with secure page. What this mean, mean that if you set a cookie with https, this cookie is NOT transmitted on non secure page, so is stay secure and a man in the middle can not steal it. The tip here is that this cookie can not be read on http pages - so you can know that the user is A, or B only on secure page.

<h2>Cart - Products</h2>

Yes this is normal : to leave the products and the cart on unsecured connection because the information is not so special. You start the https page when you be on user real data, like name, email, address etc.

<h2>Auth cookie</h2>

If you set it as secure only, then this cookies not show/read/exist on unsecured page. It is an issue if you not make it secure only.

<pre><code>Response.Cookies[s].Secure = true;
</code></pre>

<h2>Few more words</h2>

What we do with secure and non secure page is that we actually split the user data in two parts. One that is secure and one that is not. So we use actually two cookies, one secure and one not secure.

The not secure cookie is for example the one that connect all the products on the cart, or maybe the history of the user (what products see) This is also that we do not actually care if some one get it because even a proxy can see from the url the user history, or what user see.

The secure cookie is the authentication, that keep some critical information for the user. So the non secure cookie is with the user everywhere on the pages, the secure is only on check out, on logged in, etc.

<h2>Related</h2>

<a href="http://msdn.microsoft.com/en-us/library/ff648341.aspx" rel="nofollow noreferrer">MSDN, How To: Protect Forms Authentication in ASP.NET 2.0</a> 
<a href="https://stackoverflow.com/questions/6561483/setting-up-ssl-page-only-on-login-page/6561544">Setting up SSL page only on login page</a> 
<a href="https://stackoverflow.com/questions/2498599/can-some-hacker-steal-the-cookie-from-a-user-and-login-with-that-name-on-a-web-s">Can some hacker steal the cookie from a user and login with that name on a web site?</a>

I'm getting ready to have an <code>SSL cert</code> installed on my hosting. 

It is my understanding that (and correct me if I'm wrong...):

<ol>
<li>Once the hosting guys install the cert, I will be able to browse my site on <code>Http</code> or <code>Https</code> (nothing will stop me from continuing to use Http)?</li>
<li>The only thing I need to do, is add logic (in the case of MVC, Controller attributes/filters) to force certain pages, of my choosing, to redirect to <code>Https</code> (for instance, adding a <code>[RequiresHttps]</code> attribute sparingly).</li>
</ol>

Do I have to worry about doing anything extra with these things to make sure I'm using <code>SSL</code> properly? I'm not sure if I need to change something with logic having to do with:

<ol>
<li>Cookies</li>
<li>PayPal Express integration</li>
</ol>

Also, I plan on adding <code>[RequiresHttps]</code> only on the shopping cart, checkout, login, account, and administration pages. I wish to leave my product browsing/shopping pages on <code>Http</code> since I heard there is more overhead for using <code>Https</code>. Is this normal/acceptable/ok?

One more question... I know ASP.NET stores some login information in the form of an Auth cookie. It is okay that a user logs in within an <code>Https</code> page, but then can go back and browse in an <code>Http</code> page? I'm wondering if that creates a security weakness since the user is logged in and browsing in <code>Http</code> again. Does that ruin the point of using <code>SSL</code>?

I'm kind of a newb at this... so help would be appreciated.

Preparing my ASP.NET / MVC site to use SSL?

身份验证

我正准备在我的主机上安装一个SSL cert。这是我的理解(如果我错了，请纠正我…)：一旦托管人员安装了证书，我将能够在Http或Https上浏览我的网站(没有什么可以阻止我继续使用Http)？我唯一需要做的就是添加逻辑(对于MVC，控制器属性/筛选器)，以强制我选择的某些页面重定向到Https (例如，少量添加[Re...

问准备我的ASP.NET / MVC站点以使用SSL？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问准备我的ASP.NET / MVC站点以使用SSL？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问准备我的ASP.NET / MVC站点以使用SSL？
EN